Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.11.05.1, updated 2026-11-04. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-24231 | patreon-wordpress (WordPress plugin) | The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers | medium | 6.5 | 1% |
| CVE-2021-24779 | wp-debugging (WordPress plugin) | The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and | medium | 6.5 | 1% |
| CVE-2021-25081 | wp-google-map (WordPress plugin) | The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow | medium | 6.5 | 1% |
| CVE-2023-28850 | pimcore/perspective-editor | Pimcore Perspective Editor vulnerable to stored cross-site scripting (XSS) in perspective name | medium | 6.1 | 1% |
| CVE-2018-16638 | evolutioncms/evolution | Evolution CMS Cross-site Scripting (XSS) | medium | 5.4 | 1% |
| CVE-2023-0708 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_first_name' shortcode to ech | medium | 5.4 | 1% |
| CVE-2023-5845 | simple-social-buttons (WordPress plugin) | The Simple Social Media Share Buttons WordPress plugin before 5.1.1 leaks password-protected post content to unauthenticated visitors in som | medium | 5.3 | 1% |
| CVE-2024-1452 | generateblocks (WordPress plugin) | The GenerateBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.2 via Quer | medium | 4.3 | 1% |
| CVE-2025-67847 | moodle/moodle | Moodle affected by a code injection vulnerability | high | 8.8 | 1% |
| CVE-2023-4395 | cockpit-hq/cockpit | Cockpit Cross-site Scripting vulnerability | high | 8.1 | 1% |
| CVE-2024-30478 | bulletin (WordPress plugin) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bulletin WordPress Announcement & Noti | high | 7.6 | 1% |
| CVE-2022-0421 | five-star-restaurant-reservations (WordPress plugin) | The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was success | medium | 6.1 | 1% |
| CVE-2022-23896 | admidio/admidio | Cross-site Scripting in admidio | medium | 5.4 | 1% |
| CVE-2023-3709 | royal-elementor-addons (WordPress plugin) | The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 | medium | 5.3 | 1% |
| CVE-2024-13265 | drupal/opigno_learning_path | The Opigno Learning Path module enables you to manage group content. Administrative forms allow uploading malicious fil | unknown | 0.0 | 1% |
| CVE-2026-62993 | smarty/smarty | Smarty: SSRF via redirect bypass of trusted_uri using {fetch} | medium | 0.0 | 1% |
| CVE-2025-2056 | hide-my-wp (WordPress plugin) | The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Path Traversal in all versions up to, and includ | high | 7.5 | 1% |
| CVE-2023-4719 | simple-membership (WordPress plugin) | The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `list_type` parameter in versions up to, | high | 7.2 | 1% |
| CVE-2024-13330 | justrows-free (WordPress plugin) | The JustRows free WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a | high | 7.1 | 1% |
| CVE-2024-13625 | tube-video-ads-lite (WordPress plugin) | The Tube Video Ads Lite WordPress plugin through 1.5.7 does not sanitise and escape a parameter before outputting it back in the page, leadi | high | 7.1 | 1% |
| CVE-2024-1535 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.4 | 1% |
| CVE-2022-33156 | brotkrueml/typo3-matomo-integration | brotkrueml/typo3-matomo-integration vulnerable to Cross-Site Scripting | medium | 6.1 | 1% |
| CVE-2022-33157 | subhh/libconnect | libconnect Extension for Typo3 Vulnerable to XSS | medium | 6.1 | 1% |
| CVE-2022-4825 | download-wp-showhide (WordPress plugin) | The WP-ShowHide WordPress plugin before 1.05 does not validate and escape some of its shortcode attributes before outputting them back in th | medium | 5.4 | 1% |
| CVE-2022-4838 | clean-login (WordPress plugin) | The Clean Login WordPress plugin before 1.13.7 does not validate and escape some of its shortcode attributes before outputting them back in | medium | 5.4 | 1% |
| CVE-2023-0062 | ean-for-woocommerce (WordPress plugin) | The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before outputting them b | medium | 5.4 | 1% |
| CVE-2023-0082 | exactmetrics (WordPress plugin) | The ExactMetrics WordPress plugin before 7.12.1 does not validate and escape some of its block options before outputting them back in a page | medium | 5.4 | 1% |
| CVE-2023-0095 | page-view-count (WordPress plugin) | The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a pa | medium | 5.4 | 1% |
| CVE-2023-0170 | html5-audio-player (WordPress plugin) | The Html5 Audio Player WordPress plugin before 2.1.12 does not validate and escape some of its shortcode attributes before outputting them b | medium | 5.4 | 1% |
| CVE-2023-0173 | drag-\&-drop-sales-funnel-builder (WordPress plugin) | The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before | medium | 5.4 | 1% |
| CVE-2023-0176 | giveaways-and-contests-by-rafflepress (WordPress plugin) | The Giveaways and Contests by RafflePress WordPress plugin before 1.11.3 does not validate and escape some of its shortcode attributes befor | medium | 5.4 | 1% |
| CVE-2023-0178 | annual-archive (WordPress plugin) | The Annual Archive WordPress plugin before 1.6.0 does not validate and escape some of its shortcode attributes before outputting them back i | medium | 5.4 | 1% |
| CVE-2023-3403 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pm_upload_ | medium | 5.4 | 1% |
| CVE-2023-44771 | tribalsystems/zenario | Zenario CMS Cross-site Scripting vulnerability | medium | 5.4 | 1% |
| CVE-2021-36843 | floating-social-media-icon (WordPress plugin) | Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) | medium | 4.8 | 1% |
| CVE-2021-36920 | download-monitor (WordPress plugin) | Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6). | medium | 4.8 | 1% |
| CVE-2023-1169 | ooohboi-steroids-for-elementor (WordPress plugin) | The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'fil | medium | 4.3 | 1% |
| CVE-2026-31019 | dolibarr/dolibarr | Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions | high | 8.8 | 1% |
| CVE-2024-21544 | spatie/browsershot | Browsershot Local File Inclusion | high | 8.6 | 1% |
| CVE-2021-24642 | scroll-banner (WordPress plugin) | The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, esca | medium | 6.5 | 1% |
| CVE-2021-24675 | one-user-avatar (WordPress plugin) | The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortco | medium | 6.5 | 1% |
| CVE-2021-24735 | compact-wp-audio-player (WordPress plugin) | The Compact WP Audio Player WordPress plugin before 1.9.7 does not implement nonce checks, which could allow attackers to make a logged in a | medium | 6.5 | 1% |
| CVE-2024-1519 | wp-user-avatar (WordPress plugin) | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre | medium | 6.5 | 1% |
| CVE-2024-3550 | shortcodes-ultimate (WordPress plugin) | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode( | medium | 6.4 | 1% |
| CVE-2024-3743 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Stack Group, Shape Separator, C | medium | 6.4 | 1% |
| CVE-2024-26128 | baserproject/basercms | baserCMS Cross-site Scripting vulnerability in Content Management | medium | 5.4 | 1% |
| CVE-2024-1088 | password-protected-woo-store (WordPress plugin) | The Password Protected Store for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and | medium | 5.3 | 1% |
| CVE-2021-36866 | easy-pricing-tables (WordPress plugin) | Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Easy Pricing Tables plugin <= 3.1.2 at | medium | 4.8 | 1% |
| CVE-2022-34648 | uploading-svgwebp-and-ico-files (WordPress plugin) | Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 | medium | 4.8 | 1% |
| CVE-2022-4932 | boldgrid-backup (WordPress plugin) | The Total Upkeep plugin for WordPress is vulnerable to information disclosure in versions up to, and including 1.14.13. This is due to missi | medium | 4.3 | 1% |